Which of the following is MOST important to include in security awareness training?

How to respond to various types of suspicious activity

The importance of complex passwords

Descriptions of the organization's security infrastructure

Contact information for the organization's security team

A core system fails a week after a scheduled update, causing an outage that impacts service. Which of the following is MOST important for incident management to focus on when addressing the issue?

Restoring the system to operational state as quickly as possible

Analyzing the root cause of the outage to ensure the incident will not reoccur

Restoring the system to operational state as quickly as possible

Ensuring all resolution steps are fully documented prior to returning the system to service

Rolling back the unsuccessful change to the previous state

Which of the following is MOST helpful for an IS auditor to review when evaluating an organizations business process that are supported by applications and IT systems?

Configuration management database (CMDB)

Which of the following would be of GREATEST concern to an IS auditor reviewing an IT strategy document?

Strategic IT goals are derived solely from the latest market trends.

Target architecture is defined at a technical level.

The previous year's IT strategic goals were not achieved.

Strategic IT goals are derived solely from the latest market trends.

Financial estimates of new initiatives are disclosed within the document.

An organization has shifted from a bottom-up approach to a top-down approach in the development of IT policies. This should result in:

greater consistency across the organization.

a synthesis of existing operational policies.

a more comprehensive risk assessment plan.

greater adherence to best practices.

An organization considering the outsourcing of a business application should FIRST:

conduct a cost-benefit analysis.

define service level requirements.

perform a vulnerability assessment.

conduct a cost-benefit analysis.

issue a request for proposal (RFP).

Which of the following is an example of a preventive control for physical access?

Implementing a fingerprint-based access control system for the building

Keeping log entries for all visitors to the building

Implementing a fingerprint-based access control system for the building

Installing closed-circuit television (CCTV) cameras for all ingress and egress points

Implementing a centralized logging server to record instances of staff logging into workstations

The BEST way to evaluate the effectiveness of a newly developed application is to:

review acceptance testing results.

perform a post-implementation review-

review acceptance testing results.

Which of the following is the PRIMARY objective of implementing privacy-related controls within an organization?

To comply with legal and regulatory requirements

To prevent confidential data loss

To comply with legal and regulatory requirements

To identify data at rest and data in transit for encryption

To provide options to individuals regarding use of their data

An organization that operates an e-commerce website wants to provide continuous service to its customers and is planning to invest in a hot site due to service criticality. Which of the following is the MOST important consideration when making this decision?

Maximum tolerable downtime (MTD)

Which of the following is an IS auditor's BEST recommendation for mitigating risk associated with inadvertent disclosure of sensitive information by employees?

Data loss prevention (DLP) technologies

Intrusion prevention system (IPS) and firewalls

Data loss prevention (DLP) technologies

Email phishing simulation exercises

Which of the following will provide the GREATEST assurance to IT management that a quality management system (QMS) is effective?

A high percentage of stakeholders satisfied with the quality of IT

Ahigh percentage of incidents being quickly resolved

Ahigh percentage of IT processes reviewed by quality assurance (QA)

Ahigh percentage of IT employees attending quality training

Which of the following is MOST important for an IS auditor to confirm when reviewing an organization's incident response management program?

The alerting tools and incident response team can detect incidents.

All incidents have a severity level assigned.

All identified incidents are escalated to the CEO and the CISO.

Incident response is within defined service level agreements (SLAs).

The alerting tools and incident response team can detect incidents.

Which of the following is MOST appropriate to review when determining if the work completed on an IT project is in alignment with budgeted costs?

Return on investment (ROI) analysis

The PRIMARY reason to perform internal quality assurance (QA) for an internal audit function is to ensure:

internal audit activity conforms with audit standards and methodology.

audit resources are used most effectively.

internal audit activity conforms with audit standards and methodology.

the audit function is adequately governed and meets performance metrics.

inherent risk in audits is minimized.

A source code repository should be designed to:

provide secure versioning and backup capabilities for existing code.

prevent changes from being incorporated into existing code.

prevent developers from accessing secure source code.

provide secure versioning and backup capabilities for existing code.

provide automatic incorporation and distribution of modified code.

When designing a data analytics process, which of the following should be the stakeholder's role in automating data extraction and validation?

Indicating which data elements are necessary to make informed decisions

Allocating the resources necessary to purchase the appropriate software packages

Performing the business case analysis for the data analytics initiative

Designing the workflow necessary for the data analytics tool to evaluate the appropriate data

Which of the following presents the GREATEST risk to an organization's ability to manage quality control (QC) processes?

Lack of policies and procedures

Lack of a dedicated QC function

Lack of policies and procedures

Lack of formal training and attestation

A configuration management audit identified that predefined automated procedures are used when deploying and configuring application infrastructure in a cloud-based environment. Which of the following is MOST important for the IS auditor to review?

Processes for making changes to cloud environment specifications

Storage location of configuration management documentation

Processes for making changes to cloud environment specifications

Contracts of vendors responsible for maintaining provisioning tools

Number of administrators with access to cloud management consoles

Which of the following is the MOST effective way to detect as many abnormalities as possible during an IS audit?

Use a data analytics tool to identify trends.

Conduct a walk-through of the process.

Perform substantive testing on sampled records.

Perform judgmental sampling of key processes.

Use a data analytics tool to identify trends.

Which of the following is a PRIMARY benefit of using risk assessments to determine areas to be included in an audit plan?

Effective allocation of audit resources

Reduced travel and expense costs

An IS auditor is conducting an IT governance audit and notices many initiatives are managed informally by isolated project managers. Which of the following recommendations would have the GREATEST impact on improving the maturity of the IT team?

Create an interdisciplinary IT steering committee to oversee IT prioritization and spending.

Schedule a follow-up audit in the next year to confirm whether IT processes have matured.

Create an interdisciplinary IT steering committee to oversee IT prioritization and spending.

Document and track all IT decisions in a project management tool.

Discontinue all current IT projects until formal approval is obtained and documented.

Which of the following should be the GREATEST concern for an IS auditor assessing an organization's disaster recovery plan (DRP)?

The DRP has not been tested during the past three years.

The DRP was developed by the IT department.

The DRP has not been tested during the past three years.

The DRP has not been updated for two years.

The DRP does not include the recovery the time objective (RTO) for a key system.

A programmer has made unauthorized changes to key fields in a payroll system report. Which of the following control weaknesses would have contributed MOST to this problem?

The programmer has access to the production programs.

The programmer did not involve the user in testing.

The user requirements were not documented.

Payroll files were not under the control of a librarian.

The programmer has access to the production programs.

Which of the following is MOST important when defining the IS audit scope?

Understanding the relationship between IT and business risks

Minimizing the time and cost to the organization of IS audit procedures

Involving business in the formulation of the scope statement

Aligning the IS audit procedures with IT management priorities

Understanding the relationship between IT and business risks

An IS auditor is assessing the adequacy of management's remediation action plan. Which of the following should be the MOST important consideration?

Plan approval by the audit committee

During a physical security audit, an IS auditor was provided a proximity badge that granted access to three specific floors in a corporate office building. Which of the following issues should be of MOST concern?

The proximity badge incorrectly granted access to restricted areas.

The proximity badge did not work for the first two days of audit fieldwork.

There was no requirement for an escort during fieldwork.

There was no follow-up for unsuccessful attempted access violations.

The proximity badge incorrectly granted access to restricted areas.

Which of the following BEST ensures that effective change management is in place in an IS environment?

Access to production source and object programs is well controlled.

User authorization procedures for application access are well established.

User-prepared detailed test criteria for acceptance testing of the software.

Adequate testing was carried out by the development team.

Access to production source and object programs is well controlled.

An IS auditor discovers from patch logs that some in-scope systems are not compliant with the regular patching schedule. What should the auditor do NEXT?

Review the organization's patch management policy.

Interview IT management to clarify the current procedure.

Report this finding to senior management.

Review the organization's patch management policy.

Request a plan of action to be established as a follow-up item.

Which of the following applications has the MOST inherent risk and should be prioritized during audit planning?

An outsourced accounting application

A decommissioned legacy application

An onsite application that is unsupported

An outsourced accounting application

An internally developed application

During an audit of payment services of a branch based in a foreign country, a large global bank's audit team identifies an opportunity to use data analytics techniques to identify abnormal payments. Which of the following is the team's MOST important course of action?

Consult the legal department to understand the procedure for requesting data from a different jurisdiction.

Conduct a walk through of the analytical strategy with stakeholders of the audited branch to obtain their buy-in.

Request the data from the branch as the team audit charter covers the country where it is based.

Agree on a data extraction and sharing strategy with the IT team of the audited branch.

Which of the following is the BEST way to foster continuous improvement of IS audit processes and practices?

Establish and embed quality assurance (QA) within the IS audit function.

Invite external auditors and regulators to perform regular assessments of the IS audit function.

Implement rigorous managerial review and sign-off of IS audit deliverables.

Frequently review IS audit policies, procedures, and instruction manuals.

Establish and embed quality assurance (QA) within the IS audit function.

Which of the following BEST indicates that the effectiveness of an organization's security awareness program has improved?

An increase in the number of phishing emails reported by employees

A decrease in the number of information security audit findings

An increase in the number of staff who complete awareness training

An increase in the number of phishing emails reported by employees

A decrease in the number of malware outbreaks

Which of the following should be the GREATEST concern to an IS auditor reviewing the information security framework of an organization?

The information security policy is not aligned with regulatory requirements.

The information security policy has not been updated in the last two years.

Senior management was not involved in the development of the information security policy.

A list of critical information assets was not included in the information security policy.

The information security policy is not aligned with regulatory requirements.

An IS auditor finds that a recently deployed application has a number of developers with inappropriate update access left over from the testing environment. Which of the following would have BEST prevented the update access from being migrated?

Including a step within the system development life cycle (SDLC) to clean up access prior to go-live

Establishing a role-based matrix for provisioning users

Re-assigning user access rights in the quality assurance (QA) environment

Holding the application owner accountable for application security

Including a step within the system development life cycle (SDLC) to clean up access prior to go-live

Isaca CISA Practice Test 18 - Free Online Exam Prep & Questions

What should an IS auditor evaluate FIRST when reviewing an organization's response to new privacy legislation?

Become a Premium Member for full access

Unlock Premium Member

Isaca CISA Practice Test 18

Question

Isaca CISA Practice Tests

Practice Tests